North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: distributed attack, high or not

  • From: Tom Sands
  • Date: Thu Jan 31 10:38:06 2002

"Joseph T. Klein" wrote:

> I saw what appears to be a distributed attack against a single IP
> address that reached nearly 500Mbs. I was thinking that this is
> high. Are people seeing any random attacks of this magnitude?
> --
> Joseph T. Klein
> [email protected]

We have seen attacks of this magnitude on a rise.  Most of the attacks
however haven't been spoofed.   Spoofing is not really needed when
generating an attack of this size from possibly thousands of machines,
especially when targeting only a single IP.  The ability to  track such
a large attack with so many sources is fairly slim.  When seeing so many
random sources I wouldn't immediately assume it's spoofed.

Tom Sands
Chief Network Engineer
RackSpace Managed Hosting
[email protected]